CVE-2026-107891 reveals multiple integer overflow vulnerabilities in musl libc's regcomp() function that can cause incorrect memory allocations and out-of-bounds heap writes. The exploit conditions are triggered by the size and complexity of regular expression patterns themselves, not the target data being matched. Applications processing untrusted or malformed regex patterns are vulnerable to potential remote code execution.
Background
musl libc is a lightweight, fast, and standards-compliant implementation of the C standard library commonly used in embedded systems, containers, and some Linux distributions as an alternative to glibc. The regcomp() function compiles POSIX regular expression patterns into internal representation structures for subsequent matching operations.
- Source
- Lobsters
- Published
- Oct 22, 2026 at 01:40 AM
- Score
- 8.0 / 10